CVE-2026-0573

GitHub Enterprise Server suffered an URL redirection vulnerability in the repository_pages API where HTTP redirects preserved the Authorization header containing a privileged JWT. An authenticated user could redirect artifact URL fetches to an attacker-controlled domain, exfiltrate the Actions.Ma...

CVE-2026-0573 Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repositorypages API insecurely followed HTTP redirects when fetching artifact URLs, preserving the authorization header containing a...